ACR Stealer - Masqueraded Scheduled Task Persistence
Detects creation of a hidden scheduled task disguised as a legitimate software update, a persistence technique used by ACR Stealer's Campaign 1 installer stage. The malware extracts payloads into deceptive AppData directories such as LogiOptionsPlus and registers a scheduled task to relaunch a pythonw.exe-based Python loader at user sign-in.
YARA-L
